Detections
Analytics
Oracle Enterprise Data Quality Multiple Vulnerabilities (October 2014 CPU)
high Nessus Plugin ID 78749
Language:
Synopsis
The remote host is affected by multiple vulnerabilities.Description
The version of Oracle Enterprise Data Quality running on the remote host is affected by multiple vulnerabilities :- A flaw in Apache Commons BeanUtils allows a remote attacker to execute arbitrary code by manipulating the ClassLoader. (CVE-2014-0114)
- A flaw in Apache Tomcat allows a remote attacker to replace the XML parsers and thereby gain access to sensitive information. (CVE-2014-0119)
Solution
Apply the appropriate patch according to the October 2014 Oracle Critical Patch Update advisory.See Also
Plugin Details
Severity: High
ID: 78749
File Name: oracle_edq_oct_2014_cpu.nasl
Version: 1.12
Type: remote
Family: CGI abuses
Published: 10/30/2014
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.5
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.2
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:oracle:fusion_middleware
Required KB Items: installed_sw/Oracle Enterprise Data Quality Director
Exploit Available: true
Exploit Ease: No exploit is required
Patch Publication Date: 10/14/2014
Vulnerability Publication Date: 4/29/2014
Exploitable With
Metasploit (Apache Struts ClassLoader Manipulation Remote Code Execution)
Reference Information
CVE: CVE-2014-0114, CVE-2014-0119